2 * Copyright (c) 2016 Apple Inc. All Rights Reserved.
4 * @APPLE_LICENSE_HEADER_START@
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
21 * @APPLE_LICENSE_HEADER_END@
24 #import "keychain/ckks/CKKSViewManager.h"
25 #import "keychain/ckks/CKKSKeychainView.h"
26 #import "keychain/ckks/CKKSSynchronizeOperation.h"
27 #import "keychain/ckks/CKKSKey.h"
28 #import "keychain/ckks/CKKSZoneStateEntry.h"
29 #import "keychain/ckks/CKKSNearFutureScheduler.h"
30 #import "keychain/ckks/CKKSNotifier.h"
31 #import "keychain/ckks/CKKSCondition.h"
32 #import "keychain/ckks/CloudKitCategories.h"
33 #import "keychain/categories/NSError+UsefulConstructors.h"
35 #import "keychain/ot/OTDefines.h"
37 #import "SecEntitlements.h"
39 #include <securityd/SecDbItem.h>
40 #include <securityd/SecDbKeychainItem.h>
41 #include <securityd/SecItemSchema.h>
42 #include <Security/SecureObjectSync/SOSViews.h>
44 #import <Foundation/NSXPCConnection.h>
45 #import <Foundation/NSXPCConnection_Private.h>
47 #include <Security/SecureObjectSync/SOSAccount.h>
48 #include <Security/SecItemBackup.h>
51 #import <CloudKit/CloudKit.h>
52 #import <CloudKit/CloudKit_Private.h>
54 #import <SecurityFoundation/SFKey.h>
55 #import <SecurityFoundation/SFKey_Private.h>
57 #import "CKKSAnalytics.h"
60 @interface CKKSViewManager () <NSXPCListenerDelegate>
62 @property NSXPCListener *listener;
64 // Once you set these, all CKKSKeychainViews created will use them
65 @property (readonly) Class<CKKSFetchRecordZoneChangesOperation> fetchRecordZoneChangesOperationClass;
66 @property (readonly) Class<CKKSFetchRecordsOperation> fetchRecordsOperationClass;
67 @property (readonly) Class<CKKSQueryOperation> queryOperationClass;
68 @property (readonly) Class<CKKSModifySubscriptionsOperation> modifySubscriptionsOperationClass;
69 @property (readonly) Class<CKKSModifyRecordZonesOperation> modifyRecordZonesOperationClass;
70 @property (readonly) Class<CKKSAPSConnection> apsConnectionClass;
71 @property (readonly) Class<CKKSNotifier> notifierClass;
72 @property (readonly) Class<CKKSNSNotificationCenter> nsnotificationCenterClass;
74 @property NSMutableDictionary<NSString*, CKKSKeychainView*>* views;
76 @property NSMutableDictionary<NSString*, SecBoolNSErrorCallback>* pendingSyncCallbacks;
77 @property CKKSNearFutureScheduler* savedTLKNotifier;;
78 @property NSOperationQueue* operationQueue;
80 @property NSMapTable<dispatch_queue_t, id<CKKSPeerUpdateListener>>* peerChangeListeners;
85 @interface CKKSViewManager (lockstateTracker) <CKKSLockStateNotification>
89 @implementation CKKSViewManager
92 - (instancetype)initCloudKitWithContainerName: (NSString*) containerName usePCS:(bool)usePCS {
93 return [self initWithContainerName:containerName
95 fetchRecordZoneChangesOperationClass:[CKFetchRecordZoneChangesOperation class]
96 fetchRecordsOperationClass:[CKFetchRecordsOperation class]
97 queryOperationClass:[CKQueryOperation class]
98 modifySubscriptionsOperationClass:[CKModifySubscriptionsOperation class]
99 modifyRecordZonesOperationClass:[CKModifyRecordZonesOperation class]
100 apsConnectionClass:[APSConnection class]
101 nsnotificationCenterClass:[NSNotificationCenter class]
102 notifierClass:[CKKSNotifyPostNotifier class]];
105 - (instancetype)initWithContainerName: (NSString*) containerName
107 fetchRecordZoneChangesOperationClass: (Class<CKKSFetchRecordZoneChangesOperation>) fetchRecordZoneChangesOperationClass
108 fetchRecordsOperationClass: (Class<CKKSFetchRecordsOperation>)fetchRecordsOperationClass
109 queryOperationClass: (Class<CKKSQueryOperation>)queryOperationClass
110 modifySubscriptionsOperationClass: (Class<CKKSModifySubscriptionsOperation>) modifySubscriptionsOperationClass
111 modifyRecordZonesOperationClass: (Class<CKKSModifyRecordZonesOperation>) modifyRecordZonesOperationClass
112 apsConnectionClass: (Class<CKKSAPSConnection>) apsConnectionClass
113 nsnotificationCenterClass: (Class<CKKSNSNotificationCenter>) nsnotificationCenterClass
114 notifierClass: (Class<CKKSNotifier>) notifierClass
116 if(self = [super init]) {
117 _fetchRecordZoneChangesOperationClass = fetchRecordZoneChangesOperationClass;
118 _fetchRecordsOperationClass = fetchRecordsOperationClass;
119 _queryOperationClass = queryOperationClass;
120 _modifySubscriptionsOperationClass = modifySubscriptionsOperationClass;
121 _modifyRecordZonesOperationClass = modifyRecordZonesOperationClass;
122 _apsConnectionClass = apsConnectionClass;
123 _nsnotificationCenterClass = nsnotificationCenterClass;
124 _notifierClass = notifierClass;
126 _container = [self makeCKContainer: containerName usePCS:usePCS];
127 _accountTracker = [[CKKSCKAccountStateTracker alloc] init:self.container nsnotificationCenterClass:nsnotificationCenterClass];
128 _lockStateTracker = [[CKKSLockStateTracker alloc] init];
129 [_lockStateTracker addLockStateObserver:self];
130 _reachabilityTracker = [[CKKSReachabilityTracker alloc] init];
132 _zoneChangeFetcher = [[CKKSZoneChangeFetcher alloc] initWithContainer:_container
133 fetchClass:fetchRecordZoneChangesOperationClass
134 reachabilityTracker:_reachabilityTracker];
136 _operationQueue = [[NSOperationQueue alloc] init];
138 // Backwards from how we'd like, but it's the best way to have weak pointers to CKKSPeerUpdateListener.
139 _peerChangeListeners = [NSMapTable strongToWeakObjectsMapTable];
141 _views = [[NSMutableDictionary alloc] init];
142 _pendingSyncCallbacks = [[NSMutableDictionary alloc] init];
144 _initializeNewZones = false;
146 _completedSecCKKSInitialize = [[CKKSCondition alloc] init];
148 __weak __typeof(self) weakSelf = self;
149 _savedTLKNotifier = [[CKKSNearFutureScheduler alloc] initWithName:@"newtlks"
151 keepProcessAlive:true
152 dependencyDescriptionCode:CKKSResultDescriptionNone
154 [weakSelf notifyNewTLKsInKeychain];
157 _listener = [NSXPCListener anonymousListener];
158 _listener.delegate = self;
161 // If this is a live server, register with notify
162 if(!SecCKKSTestsEnabled()) {
164 notify_register_dispatch(kSOSCCCircleOctagonKeysChangedNotification, &token, dispatch_get_global_queue(QOS_CLASS_UTILITY, 0), ^(int t) {
165 // Since SOS doesn't change the self peer, we can reliably just send "trusted peers changed"; it'll be mostly right
166 secnotice("ckksshare", "Received a notification that the SOS Octagon peer set changed");
167 [weakSelf sendTrustedPeerSetChangedUpdate];
174 -(CKContainer*)makeCKContainer:(NSString*)containerName usePCS:(bool)usePCS {
175 CKContainer* container = [CKContainer containerWithIdentifier:containerName];
177 CKContainerOptions* containerOptions = [[CKContainerOptions alloc] init];
178 containerOptions.bypassPCSEncryption = YES;
180 // We don't have a great way to set these, so replace the entire container object
181 container = [[CKContainer alloc] initWithContainerID: container.containerID options:containerOptions];
186 - (void)setupAnalytics
188 __weak __typeof(self) weakSelf = self;
190 // Tests shouldn't continue here; it leads to entitlement crashes with CloudKit if the mocks aren't enabled when this function runs
191 if(SecCKKSTestsEnabled()) {
195 [[CKKSAnalytics logger] AddMultiSamplerForName:@"CKKS-healthSummary" withTimeInterval:SFAnalyticsSamplerIntervalOncePerReport block:^NSDictionary<NSString *,NSNumber *> *{
196 __strong __typeof(self) strongSelf = weakSelf;
201 NSMutableDictionary* values = [NSMutableDictionary dictionary];
202 BOOL inCircle = (strongSelf.accountTracker.currentCircleStatus == kSOSCCInCircle);
204 [[CKKSAnalytics logger] setDateProperty:[NSDate date] forKey:CKKSAnalyticsLastInCircle];
206 values[CKKSAnalyticsInCircle] = @(inCircle);
208 BOOL validCredentials = strongSelf.accountTracker.currentCKAccountInfo.hasValidCredentials;
209 if (!validCredentials) {
210 values[CKKSAnalyticsValidCredentials] = @(validCredentials);
213 NSArray<NSString *>* keys = @[ CKKSAnalyticsLastUnlock, CKKSAnalyticsLastInCircle];
214 for (NSString * key in keys) {
215 NSDate *date = [[CKKSAnalytics logger] datePropertyForKey:key];
216 values[key] = @([CKKSAnalytics fuzzyDaysSinceDate:date]);
221 for (NSString* viewName in [self viewList]) {
222 [[CKKSAnalytics logger] AddMultiSamplerForName:[NSString stringWithFormat:@"CKKS-%@-healthSummary", viewName] withTimeInterval:SFAnalyticsSamplerIntervalOncePerReport block:^NSDictionary<NSString *,NSNumber *> *{
223 __strong __typeof(self) strongSelf = weakSelf;
227 BOOL inCircle = strongSelf.accountTracker && strongSelf.accountTracker.currentCircleStatus == kSOSCCInCircle;
228 NSMutableDictionary* values = [NSMutableDictionary dictionary];
229 CKKSKeychainView* view = [strongSelf findOrCreateView:viewName];
230 NSDate* dateOfLastSyncClassA = [[CKKSAnalytics logger] dateOfLastSuccessForEvent:CKKSEventProcessIncomingQueueClassA inView:view];
231 NSDate* dateOfLastSyncClassC = [[CKKSAnalytics logger] dateOfLastSuccessForEvent:CKKSEventProcessIncomingQueueClassC inView:view];
232 NSDate* dateOfLastKSR = [[CKKSAnalytics logger] datePropertyForKey:CKKSAnalyticsLastKeystateReady inView:view];
234 NSInteger fuzzyDaysSinceClassASync = [CKKSAnalytics fuzzyDaysSinceDate:dateOfLastSyncClassA];
235 NSInteger fuzzyDaysSinceClassCSync = [CKKSAnalytics fuzzyDaysSinceDate:dateOfLastSyncClassC];
236 NSInteger fuzzyDaysSinceKSR = [CKKSAnalytics fuzzyDaysSinceDate:dateOfLastKSR];
237 [values setValue:@(fuzzyDaysSinceClassASync) forKey:[NSString stringWithFormat:@"%@-daysSinceClassASync", viewName]];
238 [values setValue:@(fuzzyDaysSinceClassCSync) forKey:[NSString stringWithFormat:@"%@-daysSinceClassCSync", viewName]];
239 [values setValue:@(fuzzyDaysSinceKSR) forKey:[NSString stringWithFormat:@"%@-daysSinceLastKeystateReady", viewName]];
241 BOOL hasTLKs = [view.keyHierarchyState isEqualToString:SecCKKSZoneKeyStateReady] || [view.keyHierarchyState isEqualToString:SecCKKSZoneKeyStateReadyPendingUnlock];
242 /* only synced recently if between [0...7, ie withing 7 days */
243 BOOL syncedClassARecently = fuzzyDaysSinceClassASync >= 0 && fuzzyDaysSinceClassASync < 7;
244 BOOL syncedClassCRecently = fuzzyDaysSinceClassCSync >= 0 && fuzzyDaysSinceClassCSync < 7;
245 BOOL incomingQueueIsErrorFree = view.lastIncomingQueueOperation.error == nil;
246 BOOL outgoingQueueIsErrorFree = view.lastOutgoingQueueOperation.error == nil;
248 NSString* hasTLKsKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsHasTLKs];
249 NSString* syncedClassARecentlyKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsSyncedClassARecently];
250 NSString* syncedClassCRecentlyKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsSyncedClassCRecently];
251 NSString* incomingQueueIsErrorFreeKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsIncomingQueueIsErrorFree];
252 NSString* outgoingQueueIsErrorFreeKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsOutgoingQueueIsErrorFree];
254 values[hasTLKsKey] = @(hasTLKs);
255 values[syncedClassARecentlyKey] = @(syncedClassARecently);
256 values[syncedClassCRecentlyKey] = @(syncedClassCRecently);
257 values[incomingQueueIsErrorFreeKey] = @(incomingQueueIsErrorFree);
258 values[outgoingQueueIsErrorFreeKey] = @(outgoingQueueIsErrorFree);
260 BOOL weThinkWeAreInSync = inCircle && hasTLKs && syncedClassARecently && syncedClassCRecently && incomingQueueIsErrorFree && outgoingQueueIsErrorFree;
261 NSString* inSyncKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsInSync];
262 values[inSyncKey] = @(weThinkWeAreInSync);
270 [self clearAllViews];
273 dispatch_queue_t globalZoneStateQueue = NULL;
274 dispatch_once_t globalZoneStateQueueOnce;
276 // We can't load the rate limiter in an init method, as the method might end up calling itself (if the database layer isn't yet initialized).
277 // Lazy-load it here.
278 - (CKKSRateLimiter*)getGlobalRateLimiter {
279 dispatch_once(&globalZoneStateQueueOnce, ^{
280 globalZoneStateQueue = dispatch_queue_create("CKKS global zone state", DISPATCH_QUEUE_SERIAL);
283 if(_globalRateLimiter != nil) {
284 return _globalRateLimiter;
287 __block CKKSRateLimiter* blocklimit = nil;
289 dispatch_sync(globalZoneStateQueue, ^{
290 NSError* error = nil;
292 // Special object containing state for all zones. Currently, just the rate limiter.
293 CKKSZoneStateEntry* allEntry = [CKKSZoneStateEntry tryFromDatabase: @"all" error:&error];
296 secerror("CKKSViewManager: couldn't load global zone state: %@", error);
299 if(!error && allEntry.rateLimiter) {
300 blocklimit = allEntry.rateLimiter;
302 blocklimit = [[CKKSRateLimiter alloc] init];
305 _globalRateLimiter = blocklimit;
306 return _globalRateLimiter;
309 - (void)lockStateChangeNotification:(bool)unlocked
312 [[CKKSAnalytics logger] setDateProperty:[NSDate date] forKey:CKKSAnalyticsLastUnlock];
316 // Mostly exists to be mocked out.
318 return CFBridgingRelease(SOSViewCopyViewSet(kViewSetCKKS));
321 - (void)setView: (CKKSKeychainView*) obj {
322 CKKSKeychainView* kcv = nil;
324 @synchronized(self.views) {
325 kcv = self.views[obj.zoneName];
326 self.views[obj.zoneName] = obj;
330 [kcv cancelAllOperations];
334 - (void)clearAllViews {
335 NSArray<CKKSKeychainView*>* tempviews = nil;
336 @synchronized(self.views) {
337 tempviews = [self.views.allValues copy];
338 [self.views removeAllObjects];
341 for(CKKSKeychainView* view in tempviews) {
342 [view cancelAllOperations];
346 - (void)clearView:(NSString*) viewName {
347 CKKSKeychainView* kcv = nil;
348 @synchronized(self.views) {
349 kcv = self.views[viewName];
350 self.views[viewName] = nil;
354 [kcv cancelAllOperations];
358 - (CKKSKeychainView*)findView:(NSString*)viewName {
362 @synchronized(self.views) {
363 return self.views[viewName];
367 - (CKKSKeychainView*)findOrCreateView:(NSString*)viewName {
368 @synchronized(self.views) {
369 CKKSKeychainView* kcv = self.views[viewName];
374 self.views[viewName] = [[CKKSKeychainView alloc] initWithContainer: self.container
376 accountTracker: self.accountTracker
377 lockStateTracker: self.lockStateTracker
378 reachabilityTracker: self.reachabilityTracker
379 changeFetcher:self.zoneChangeFetcher
380 savedTLKNotifier: self.savedTLKNotifier
382 fetchRecordZoneChangesOperationClass: self.fetchRecordZoneChangesOperationClass
383 fetchRecordsOperationClass: self.fetchRecordsOperationClass
384 queryOperationClass:self.queryOperationClass
385 modifySubscriptionsOperationClass: self.modifySubscriptionsOperationClass
386 modifyRecordZonesOperationClass: self.modifyRecordZonesOperationClass
387 apsConnectionClass: self.apsConnectionClass
388 notifierClass: self.notifierClass];
390 if(self.initializeNewZones) {
391 [self.views[viewName] initializeZone];
394 return self.views[viewName];
398 - (NSDictionary<NSString *,NSString *> *)activeTLKs
400 NSMutableDictionary<NSString *,NSString *> *tlks = [NSMutableDictionary new];
401 @synchronized(self.views) {
402 for (NSString *name in self.views) {
403 CKKSKeychainView *view = self.views[name];
404 NSString *tlk = view.lastActiveTLKUUID;
413 - (CKKSKeychainView*)restartZone:(NSString*)viewName {
414 @synchronized(self.views) {
415 [self.views[viewName] halt];
416 self.views[viewName] = nil;
418 return [self findOrCreateView: viewName];
421 // Allows all views to begin initializing, and opens the floodgates so that new views will be initalized immediately
422 - (void)initializeZones {
423 if(!SecCKKSIsEnabled()) {
424 secnotice("ckks", "Not initializing CKKS view set as CKKS is disabled");
428 @synchronized(self.views) {
429 self.initializeNewZones = true;
431 NSSet* viewSet = [self viewList];
432 for(NSString* s in viewSet) {
433 [self findOrCreateView:s]; // initializes any newly-created views
437 [self setupAnalytics];
440 - (NSString*)viewNameForViewHint: (NSString*) viewHint {
441 // For now, choose view based on viewhints.
442 if(viewHint && ![viewHint isEqual: [NSNull null]]) {
446 // If there isn't a provided view hint, use the "keychain" view if we're testing. Otherwise, nil.
447 if(SecCKKSTestsEnabled()) {
454 - (NSString*)viewNameForItem: (SecDbItemRef) item {
455 CFErrorRef cferror = NULL;
456 NSString* viewHint = (__bridge NSString*) SecDbItemGetValue(item, &v7vwht, &cferror);
459 secerror("ckks: Couldn't fetch the viewhint for some reason: %@", cferror);
460 CFReleaseNull(cferror);
464 return [self viewNameForViewHint: viewHint];
467 - (NSString*)viewNameForAttributes: (NSDictionary*) item {
468 return [self viewNameForViewHint: item[(id)kSecAttrSyncViewHint]];
471 - (void)registerSyncStatusCallback: (NSString*) uuid callback: (SecBoolNSErrorCallback) callback {
472 // Someone is requesting future notification of this item.
473 @synchronized(self.pendingSyncCallbacks) {
474 self.pendingSyncCallbacks[uuid] = callback;
478 - (void) handleKeychainEventDbConnection: (SecDbConnectionRef) dbconn source:(SecDbTransactionSource)txionSource added: (SecDbItemRef) added deleted: (SecDbItemRef) deleted {
480 SecDbItemRef modified = added ? added : deleted;
482 NSString* viewName = [self viewNameForItem: modified];
483 NSString* keyViewName = [CKKSKey isItemKeyForKeychainView: modified];
486 // This might be some key material for this view! Poke it.
487 CKKSKeychainView* view = [self findView: keyViewName];
489 if(!SecCKKSTestDisableKeyNotifications()) {
490 ckksnotice("ckks", view, "Potential new key material from %@ (source %lu)",
491 keyViewName, (unsigned long)txionSource);
492 [view keyStateMachineRequestProcess];
494 ckksnotice("ckks", view, "Ignoring potential new key material from %@ (source %lu)",
495 keyViewName, (unsigned long)txionSource);
500 // When SOS is in charge of a view, CKKS is not.
501 // Since this isn't a CKKS key item, we don't care about it.
502 if(txionSource == kSecDbSOSTransaction) {
503 secinfo("ckks", "Ignoring new non-CKKS item in kSecDbSOSTransaction notification");
506 // Looks like a normal item. Proceed!
507 CKKSKeychainView* view = [self findView:viewName];
509 NSString* uuid = (__bridge NSString*) SecDbItemGetValue(modified, &v10itemuuid, NULL);
510 SecBoolNSErrorCallback syncCallback = nil;
512 @synchronized(self.pendingSyncCallbacks) {
513 syncCallback = self.pendingSyncCallbacks[uuid];
514 self.pendingSyncCallbacks[uuid] = nil;
517 secinfo("ckks", "Have a pending callback for %@; passing along", uuid);
523 secinfo("ckks", "No CKKS view for %@, skipping: %@", viewName, modified);
525 syncCallback(false, [NSError errorWithDomain:@"securityd"
526 code:kSOSCCNoSuchView
527 userInfo:@{NSLocalizedDescriptionKey: [NSString stringWithFormat: @"No syncing view for '%@'", viewName]}]);
532 ckksnotice("ckks", view, "Routing item to zone %@: %@", viewName, modified);
533 [view handleKeychainEventDbConnection: dbconn added:added deleted:deleted rateLimiter:self.globalRateLimiter syncCallback: syncCallback];
536 -(void)setCurrentItemForAccessGroup:(NSData* _Nonnull)newItemPersistentRef
537 hash:(NSData*)newItemSHA1
538 accessGroup:(NSString*)accessGroup
539 identifier:(NSString*)identifier
540 viewHint:(NSString*)viewHint
541 replacing:(NSData* _Nullable)oldCurrentItemPersistentRef
542 hash:(NSData*)oldItemSHA1
543 complete:(void (^) (NSError* operror)) complete
545 CKKSKeychainView* view = [self findView:viewHint];
548 secnotice("ckks", "No CKKS view for %@, skipping current request", viewHint);
549 complete([NSError errorWithDomain:CKKSErrorDomain
551 description:[NSString stringWithFormat: @"No syncing view for view hint '%@'", viewHint]]);
555 [view setCurrentItemForAccessGroup:newItemPersistentRef
557 accessGroup:accessGroup
558 identifier:identifier
559 replacing:oldCurrentItemPersistentRef
564 -(void)getCurrentItemForAccessGroup:(NSString*)accessGroup
565 identifier:(NSString*)identifier
566 viewHint:(NSString*)viewHint
567 fetchCloudValue:(bool)fetchCloudValue
568 complete:(void (^) (NSString* uuid, NSError* operror)) complete
570 CKKSKeychainView* view = [self findView:viewHint];
572 secnotice("ckks", "No CKKS view for %@, skipping current fetch request", viewHint);
573 complete(NULL, [NSError errorWithDomain:CKKSErrorDomain
575 description:[NSString stringWithFormat: @"No view for '%@'", viewHint]]);
579 [view getCurrentItemForAccessGroup:accessGroup
580 identifier:identifier
581 fetchCloudValue:fetchCloudValue
586 + (instancetype) manager {
587 return [self resetManager: false setTo: nil];
590 + (instancetype) resetManager: (bool) reset setTo: (CKKSViewManager*) obj {
591 static CKKSViewManager* manager = nil;
593 if([CKDatabase class] == nil) {
594 secerror("CKKS: CloudKit.framework appears to not be linked. Can't create CKKS objects.");
598 if(!manager || reset || obj) {
599 @synchronized([self class]) {
601 [manager clearAllViews];
605 [manager clearAllViews];
607 } else if (manager == nil && SecCKKSIsEnabled()) {
608 manager = [[CKKSViewManager alloc] initCloudKitWithContainerName:SecCKKSContainerName usePCS:SecCKKSContainerUsePCS];
617 - (void)cancelPendingOperations {
618 [self.savedTLKNotifier cancel];
621 -(void)notifyNewTLKsInKeychain {
622 // Why two functions here? Limitation of OCMock, unfortunately: can't stub and expect the same method
623 secnotice("ckksbackup", "New TLKs have arrived");
624 [self syncBackupAndNotifyAboutSync];
627 - (void)syncBackupAndNotifyAboutSync {
628 SOSAccount* account = (__bridge SOSAccount*)SOSKeychainAccountGetSharedAccount();
631 secnotice("ckks", "Failed to get account object");
635 [account performTransaction:^(SOSAccountTransaction * _Nonnull txn) {
636 CFErrorRef error = NULL;
637 NSSet* ignore = CFBridgingRelease(SOSAccountCopyBackupPeersAndForceSync(txn, &error));
641 secerror("ckksbackup: Couldn't process sync with backup peers: %@", error);
643 secnotice("ckksbackup", "telling CloudServices about TLK arrival");
644 notify_post(kSecItemBackupNotification);
649 #pragma mark - RPCs to manage and report state
651 - (void)performanceCounters:(void(^)(NSDictionary <NSString *, NSNumber *> *counter))reply {
655 - (NSArray<CKKSKeychainView*>*)views:(NSString*)viewName operation:(NSString*)opName error:(NSError**)error
657 NSArray* actualViews = nil;
659 // Ensure we've actually set up, but don't wait too long. Clients get impatient.
660 if([self.completedSecCKKSInitialize wait:5*NSEC_PER_SEC]) {
661 secerror("ckks: Haven't yet initialized zones; expect failure fetching views");
664 @synchronized(self.views) {
666 CKKSKeychainView* view = self.views[viewName];
667 secnotice("ckks", "Received a %@ request for zone %@ (%@)", opName, viewName, view);
671 *error = [NSError errorWithDomain:CKKSErrorDomain
673 userInfo:@{NSLocalizedDescriptionKey: [NSString stringWithFormat: @"No view for '%@'", viewName]}];
678 actualViews = @[view];
680 actualViews = [self.views.allValues copy];
681 secnotice("ckks", "Received a %@ request for all zones: %@", opName, actualViews);
684 actualViews = [actualViews sortedArrayUsingDescriptors:@[[NSSortDescriptor sortDescriptorWithKey:@"zoneName" ascending:YES]]];
688 - (void)rpcResetLocal:(NSString*)viewName reply: (void(^)(NSError* result)) reply {
689 NSError* localError = nil;
690 NSArray* actualViews = [self views:viewName operation:@"local reset" error:&localError];
692 secerror("ckks: Error getting view %@: %@", viewName, localError);
697 CKKSResultOperation* op = [CKKSResultOperation named:@"local-reset-zones-waiter" withBlockTakingSelf:^(CKKSResultOperation * _Nonnull strongOp) {
698 if(!strongOp.error) {
699 secnotice("ckksreset", "Completed rpcResetLocal");
701 secnotice("ckks", "Completed rpcResetLocal with error: %@", strongOp.error);
703 reply(CKXPCSuitableError(strongOp.error));
706 for(CKKSKeychainView* view in actualViews) {
707 ckksnotice("ckksreset", view, "Beginning local reset for %@", view);
708 [op addSuccessDependency:[view resetLocalData]];
711 [op timeout:120*NSEC_PER_SEC];
712 [self.operationQueue addOperation: op];
715 #pragma clang diagnostic push
716 #pragma clang diagnostic ignored "-Wdeprecated-implementations"
717 - (void)rpcResetCloudKit:(NSString*)viewName reply: (void(^)(NSError* result)) reply {
718 [self rpcResetCloudKit:viewName reason:@"unknown" reply:reply];
720 #pragma clang diagnostic pop
722 - (void)rpcResetCloudKit:(NSString*)viewName reason:(NSString *)reason reply:(void(^)(NSError* result)) reply {
723 NSError* localError = nil;
724 NSArray* actualViews = [self views:viewName operation:@"CloudKit reset" error:&localError];
726 secerror("ckks: Error getting view %@: %@", viewName, localError);
731 CKKSResultOperation* op = [CKKSResultOperation named:@"cloudkit-reset-zones-waiter" withBlockTakingSelf:^(CKKSResultOperation * _Nonnull strongOp) {
732 if(!strongOp.error) {
733 secnotice("ckksreset", "Completed rpcResetCloudKit");
735 secnotice("ckksreset", "Completed rpcResetCloudKit with error: %@", strongOp.error);
737 reply(CKXPCSuitableError(strongOp.error));
740 for(CKKSKeychainView* view in actualViews) {
741 NSString *operationGroupName = [NSString stringWithFormat:@"api-reset-%@", reason];
742 ckksnotice("ckksreset", view, "Beginning CloudKit reset for %@: %@", view, reason);
743 [op addSuccessDependency:[view resetCloudKitZone:[CKOperationGroup CKKSGroupWithName:operationGroupName]]];
746 [op timeout:120*NSEC_PER_SEC];
747 [self.operationQueue addOperation: op];
750 - (void)rpcResync:(NSString*)viewName reply: (void(^)(NSError* result)) reply {
751 NSError* localError = nil;
752 NSArray* actualViews = [self views:viewName operation:@"CloudKit resync" error:&localError];
754 secerror("ckks: Error getting view %@: %@", viewName, localError);
759 CKKSResultOperation* op = [[CKKSResultOperation alloc] init];
760 op.name = @"rpc-resync-cloudkit";
761 __weak __typeof(op) weakOp = op;
762 [op addExecutionBlock:^{
763 __strong __typeof(op) strongOp = weakOp;
764 secnotice("ckks", "Ending rsync-CloudKit rpc with %@", strongOp.error);
767 for(CKKSKeychainView* view in actualViews) {
768 ckksnotice("ckksresync", view, "Beginning resync (CloudKit) for %@", view);
770 CKKSSynchronizeOperation* resyncOp = [view resyncWithCloud];
771 [op addSuccessDependency:resyncOp];
774 [op timeout:120*NSEC_PER_SEC];
775 [self.operationQueue addOperation:op];
776 [op waitUntilFinished];
777 reply(CKXPCSuitableError(op.error));
780 - (void)rpcResyncLocal:(NSString*)viewName reply:(void(^)(NSError* result))reply {
781 NSError* localError = nil;
782 NSArray* actualViews = [self views:viewName operation:@"local resync" error:&localError];
784 secerror("ckks: Error getting view %@: %@", viewName, localError);
789 CKKSResultOperation* op = [[CKKSResultOperation alloc] init];
790 op.name = @"rpc-resync-local";
791 __weak __typeof(op) weakOp = op;
792 [op addExecutionBlock:^{
793 __strong __typeof(op) strongOp = weakOp;
794 secnotice("ckks", "Ending rsync-local rpc with %@", strongOp.error);
795 reply(CKXPCSuitableError(strongOp.error));
798 for(CKKSKeychainView* view in actualViews) {
799 ckksnotice("ckksresync", view, "Beginning resync (local) for %@", view);
801 CKKSLocalSynchronizeOperation* resyncOp = [view resyncLocal];
802 [op addSuccessDependency:resyncOp];
805 [op timeout:120*NSEC_PER_SEC];
808 - (void)rpcStatus: (NSString*)viewName reply: (void(^)(NSArray<NSDictionary*>* result, NSError* error)) reply {
809 NSMutableArray* a = [[NSMutableArray alloc] init];
811 // Now, query the views about their status
812 NSError* error = nil;
813 NSArray* actualViews = [self views:viewName operation:@"status" error:&error];
814 if(!actualViews || error) {
819 __weak __typeof(self) weakSelf = self;
820 CKKSResultOperation* statusOp = [CKKSResultOperation named:@"status-rpc" withBlock:^{
821 __strong __typeof(self) strongSelf = weakSelf;
823 // The first element is always the current global state (non-view-specific)
824 NSError* selfPeersError = nil;
825 CKKSSelves* selves = [strongSelf fetchSelfPeers:&selfPeersError];
826 NSError* trustedPeersError = nil;
827 NSSet<id<CKKSPeer>>* peers = [strongSelf fetchTrustedPeers:&trustedPeersError];
829 // Get account state, even wait for it a little
830 [self.accountTracker.ckdeviceIDInitialized wait:1*NSEC_PER_SEC];
831 NSString *deviceID = self.accountTracker.ckdeviceID;
832 NSError *deviceIDError = self.accountTracker.ckdeviceIDError;
834 NSMutableArray<NSString*>* mutTrustedPeers = [[NSMutableArray alloc] init];
835 [peers enumerateObjectsUsingBlock:^(id<CKKSPeer> _Nonnull obj, BOOL * _Nonnull stop) {
836 [mutTrustedPeers addObject: [obj description]];
839 #define stringify(obj) CKKSNilToNSNull([obj description])
840 NSDictionary* global = @{
842 @"selfPeers": stringify(selves),
843 @"selfPeersError": CKKSNilToNSNull(selfPeersError),
844 @"trustedPeers": CKKSNilToNSNull(mutTrustedPeers),
845 @"trustedPeersError": CKKSNilToNSNull(trustedPeersError),
846 @"reachability": strongSelf.reachabilityTracker.currentReachability ? @"network" : @"no-network",
847 @"ckdeviceID": CKKSNilToNSNull(deviceID),
848 @"ckdeviceIDError": CKKSNilToNSNull(deviceIDError),
850 [a addObject: global];
852 for(CKKSKeychainView* view in actualViews) {
853 ckksnotice("ckks", view, "Fetching status for %@", view.zoneName);
854 NSDictionary* status = [view status];
855 ckksinfo("ckks", view, "Status is %@", status);
857 [a addObject: status];
863 // If we're signed in, give the views a few seconds to enter what they consider to be a non-transient state (in case this daemon just launched)
864 if([self.accountTracker.currentComputedAccountStatusValid wait:5*NSEC_PER_SEC]) {
865 secerror("ckks status: Haven't yet figured out login state");
868 if(self.accountTracker.currentComputedAccountStatus == CKKSAccountStatusAvailable) {
869 CKKSResultOperation* blockOp = [CKKSResultOperation named:@"wait-for-status" withBlock:^{}];
870 [blockOp timeout:8*NSEC_PER_SEC];
871 for(CKKSKeychainView* view in actualViews) {
872 [blockOp addNullableDependency:view.keyStateNonTransientDependency];
873 [statusOp addDependency:blockOp];
875 [self.operationQueue addOperation:blockOp];
877 [self.operationQueue addOperation:statusOp];
882 - (void)rpcFetchAndProcessChanges:(NSString*)viewName reply: (void(^)(NSError* result))reply {
883 [self rpcFetchAndProcessChanges:viewName classA:false reply: (void(^)(NSError* result))reply];
886 - (void)rpcFetchAndProcessClassAChanges:(NSString*)viewName reply: (void(^)(NSError* result))reply {
887 [self rpcFetchAndProcessChanges:viewName classA:true reply:(void(^)(NSError* result))reply];
890 - (void)rpcFetchAndProcessChanges:(NSString*)viewName classA:(bool)classAError reply: (void(^)(NSError* result)) reply {
891 NSError* error = nil;
892 NSArray* actualViews = [self views:viewName operation:@"fetch" error:&error];
893 if(!actualViews || error) {
898 CKKSResultOperation* blockOp = [[CKKSResultOperation alloc] init];
899 blockOp.name = @"rpc-fetch-and-process-result";
900 __weak __typeof(blockOp) weakBlockOp = blockOp;
901 // Use the completion block instead of the operation block, so that it runs even if the cancel fires
902 [blockOp setCompletionBlock:^{
903 __strong __typeof(blockOp) strongBlockOp = weakBlockOp;
904 [strongBlockOp allDependentsSuccessful];
905 reply(CKXPCSuitableError(strongBlockOp.error));
908 for(CKKSKeychainView* view in actualViews) {
909 ckksnotice("ckks", view, "Beginning fetch for %@", view);
911 CKKSResultOperation* op = [view processIncomingQueue:classAError after:[view.zoneChangeFetcher requestSuccessfulFetch: CKKSFetchBecauseAPIFetchRequest]];
912 [blockOp addDependency:op];
915 [self.operationQueue addOperation: [blockOp timeout:(SecCKKSTestsEnabled() ? NSEC_PER_SEC * 5 : NSEC_PER_SEC * 120)]];
918 - (void)rpcPushOutgoingChanges:(NSString*)viewName reply: (void(^)(NSError* result))reply {
919 NSError* error = nil;
920 NSArray* actualViews = [self views:viewName operation:@"push" error:&error];
921 if(!actualViews || error) {
926 CKKSResultOperation* blockOp = [[CKKSResultOperation alloc] init];
927 blockOp.name = @"rpc-push";
928 __weak __typeof(blockOp) weakBlockOp = blockOp;
929 // Use the completion block instead of the operation block, so that it runs even if the cancel fires
930 [blockOp setCompletionBlock:^{
931 __strong __typeof(blockOp) strongBlockOp = weakBlockOp;
932 [strongBlockOp allDependentsSuccessful];
933 reply(CKXPCSuitableError(strongBlockOp.error));
936 for(CKKSKeychainView* view in actualViews) {
937 ckksnotice("ckks-rpc", view, "Beginning push for %@", view);
939 CKKSResultOperation* op = [view processOutgoingQueue: [CKOperationGroup CKKSGroupWithName:@"rpc-push"]];
940 [blockOp addDependency:op];
943 [self.operationQueue addOperation: [blockOp timeout:(SecCKKSTestsEnabled() ? NSEC_PER_SEC * 2 : NSEC_PER_SEC * 120)]];
946 - (void)rpcGetCKDeviceIDWithReply:(void (^)(NSString *))reply {
947 reply(self.accountTracker.ckdeviceID);
950 -(void)xpc24HrNotification {
951 // XPC has poked us and said we should do some cleanup!
953 // For now, poke the views and tell them to update their device states if they'd like
954 NSArray* actualViews = nil;
955 @synchronized(self.views) {
956 // Can't safely iterate a mutable collection, so copy it.
957 actualViews = self.views.allValues;
960 secnotice("ckks", "Received a 24hr notification from XPC");
961 CKOperationGroup* group = [CKOperationGroup CKKSGroupWithName:@"periodic-device-state-update"];
962 for(CKKSKeychainView* view in actualViews) {
963 ckksnotice("ckks", view, "Starting device state XPC update");
964 // Let the update know it should rate-limit itself
965 [view updateDeviceState:true waitForKeyHierarchyInitialization:30*NSEC_PER_SEC ckoperationGroup:group];
969 - (NSArray<NSDictionary *> * _Nullable)loadRestoredBottledKeysOfType:(OctagonKeyType)keyType error:(NSError**)error
971 CFTypeRef result = NULL;
972 NSMutableArray* bottledPeerKeychainItems = nil;
974 NSDictionary* query = @{
975 (id)kSecClass : (id)kSecClassInternetPassword,
976 (id)kSecAttrAccessible: (id)kSecAttrAccessibleWhenUnlocked,
977 (id)kSecAttrNoLegacy : @YES,
978 (id)kSecAttrType : [[NSNumber alloc]initWithInt: keyType],
979 (id)kSecAttrServer : (keyType == 1) ? @"Octagon Signing Key" : @"Octagon Encryption Key",
980 (id)kSecAttrAccessGroup: @"com.apple.security.ckks",
981 (id)kSecMatchLimit : (id)kSecMatchLimitAll,
982 (id)kSecReturnAttributes: @YES,
983 (id)kSecReturnData: @YES,
985 OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef)query, &result);
987 if(status == errSecSuccess && result && isArray(result)) {
988 bottledPeerKeychainItems = CFBridgingRelease(result);
992 *error = [NSError errorWithDomain:NSOSStatusErrorDomain
994 description:@"could not load bottled peer keys"];
996 CFReleaseNull(result);
999 return bottledPeerKeychainItems;
1002 -(NSDictionary *) keychainItemForPeerID:(NSString*)neededPeerID
1003 keychainItems:(NSArray<NSDictionary*> *)keychainItems
1004 escrowSigningPubKeyHash:(NSString *)hashWeNeedToMatch
1006 NSDictionary* peerItem = nil;
1008 for(NSDictionary* item in keychainItems){
1009 if(item && [item count] > 0){
1010 NSString* peerIDFromItem = [item objectForKey:(id)kSecAttrAccount];
1011 NSString* hashToConsider = [item objectForKey:(id)kSecAttrLabel];
1012 if([peerIDFromItem isEqualToString:neededPeerID] &&
1013 [hashWeNeedToMatch isEqualToString:hashToConsider])
1015 peerItem = [item copy];
1024 - (NSSet<id<CKKSSelfPeer>>*)pastSelves:(NSError**)error
1026 NSError* localError = nil;
1028 // get bottled peer identities from the keychain
1029 NSMutableSet<id<CKKSSelfPeer>>* allSelves = [NSMutableSet set];
1030 NSArray<NSDictionary*>* signingKeys = [self loadRestoredBottledKeysOfType:OctagonSigningKey error:&localError];
1032 // Item not found isn't actually an error here
1033 if(error && !(localError && [localError.domain isEqualToString: NSOSStatusErrorDomain] && localError.code == errSecItemNotFound)) {
1034 *error = localError;
1040 NSArray<NSDictionary*>* encryptionKeys = [self loadRestoredBottledKeysOfType:OctagonEncryptionKey error:&localError];
1041 if(!encryptionKeys) {
1042 if(error && !(localError && [localError.domain isEqualToString: NSOSStatusErrorDomain] && localError.code == errSecItemNotFound)) {
1043 *error = localError;
1048 for(NSDictionary* signingKey in signingKeys) {
1049 NSError* peerError = nil;
1050 NSString* peerid = signingKey[(id)kSecAttrAccount];
1051 NSString* hash = signingKey[(id)kSecAttrLabel]; // escrow signing pub key hash
1053 //use peer id AND escrow signing public key hash to look up the matching item in encryptionKeys list
1054 NSDictionary* encryptionKeyItem = [self keychainItemForPeerID:peerid keychainItems:encryptionKeys escrowSigningPubKeyHash:hash];
1055 if(!encryptionKeyItem) {
1056 secerror("octagon: no encryption key available to pair with signing key %@,%@", peerid, hash);
1060 NSData* signingKeyData = signingKey[(id)kSecValueData];
1061 if(!signingKeyData) {
1062 secerror("octagon: no signing key data for %@,%@", peerid,hash);
1066 SFECKeyPair* restoredSigningKey = [[SFECKeyPair alloc] initWithData:signingKeyData
1067 specifier:[[SFECKeySpecifier alloc] initWithCurve:SFEllipticCurveNistp384]
1069 if(!restoredSigningKey) {
1070 secerror("octagon: couldn't make signing key for %@,%@: %@", peerid, hash, peerError);
1074 NSData* encryptionKeyData = [encryptionKeyItem objectForKey:(id)kSecValueData];
1075 if(!encryptionKeyData) {
1076 secerror("octagon: no encryption key data for %@,%@", peerid,hash);
1080 SFECKeyPair* restoredEncryptionKey = [[SFECKeyPair alloc] initWithData:encryptionKeyData
1081 specifier:[[SFECKeySpecifier alloc] initWithCurve:SFEllipticCurveNistp384]
1083 if(!restoredEncryptionKey) {
1084 secerror("octagon: couldn't make encryption key for %@,%@: %@", peerid,hash, peerError);
1088 //create the SOS self peer
1089 CKKSSOSSelfPeer* restoredIdentity = [[CKKSSOSSelfPeer alloc]initWithSOSPeerID:peerid encryptionKey:restoredEncryptionKey signingKey:restoredSigningKey];
1091 if(restoredIdentity){
1092 secnotice("octagon","adding bottled peer identity: %@", restoredIdentity);
1093 [allSelves addObject:restoredIdentity];
1095 secerror("octagon: could not create restored identity from: %@: %@", peerid, peerError);
1101 - (id<CKKSSelfPeer> _Nullable)currentSOSSelf:(NSError**)error
1103 __block SFECKeyPair* signingPrivateKey = nil;
1104 __block SFECKeyPair* encryptionPrivateKey = nil;
1106 __block NSError* localerror = nil;
1108 // Wait for this to initialize, but don't worry if it isn't.
1109 [self.accountTracker.accountCirclePeerIDInitialized wait:500*NSEC_PER_MSEC];
1110 NSString* peerID = self.accountTracker.accountCirclePeerID;
1111 if(!peerID || self.accountTracker.accountCirclePeerIDError) {
1112 secerror("ckkspeer: Error fetching self peer : %@", self.accountTracker.accountCirclePeerIDError);
1114 *error = self.accountTracker.accountCirclePeerIDError;
1119 SOSCCPerformWithAllOctagonKeys(^(SecKeyRef octagonEncryptionKey, SecKeyRef octagonSigningKey, CFErrorRef cferror) {
1121 localerror = (__bridge NSError*)cferror;
1124 if (!cferror && octagonEncryptionKey && octagonSigningKey) {
1125 signingPrivateKey = [[SFECKeyPair alloc] initWithSecKey:octagonSigningKey];
1126 encryptionPrivateKey = [[SFECKeyPair alloc] initWithSecKey:octagonEncryptionKey];
1128 localerror = [NSError errorWithDomain:CKKSErrorDomain
1129 code:CKKSNoPeersAvailable
1130 description:@"Not all SOS peer keys available, but no error returned"];
1135 if(![self.lockStateTracker isLockedError:localerror]) {
1136 secerror("ckkspeer: Error fetching self encryption keys: %@", localerror);
1139 *error = localerror;
1144 CKKSSOSSelfPeer* selfPeer = [[CKKSSOSSelfPeer alloc] initWithSOSPeerID:peerID
1145 encryptionKey:encryptionPrivateKey
1146 signingKey:signingPrivateKey];
1150 #pragma mark - CKKSPeerProvider implementation
1152 - (CKKSSelves*)fetchSelfPeers:(NSError* __autoreleasing *)error {
1153 NSError* localError = nil;
1155 id<CKKSSelfPeer> selfPeer = [self currentSOSSelf:&localError];
1156 if(!selfPeer || localError) {
1157 if(![self.lockStateTracker isLockedError:localError]) {
1158 secerror("ckks: Error fetching current SOS self: %@", localError);
1161 *error = localError;
1166 NSSet<id<CKKSSelfPeer>>* allSelves = [self pastSelves:&localError];
1167 if(!allSelves || localError) {
1168 secerror("ckks: Error fetching past selves: %@", localError);
1170 *error = localError;
1175 CKKSSelves* selves = [[CKKSSelves alloc] initWithCurrent:selfPeer allSelves:allSelves];
1179 - (NSSet<id<CKKSPeer>>*)fetchTrustedPeers:(NSError* __autoreleasing *)error {
1180 __block NSMutableSet<id<CKKSPeer>>* peerSet = [NSMutableSet set];
1182 SOSCCPerformWithTrustedPeers(^(CFSetRef sosPeerInfoRefs, CFErrorRef cfTrustedPeersError) {
1183 if(cfTrustedPeersError) {
1184 secerror("ckks: Error fetching trusted peers: %@", cfTrustedPeersError);
1186 *error = (__bridge NSError*)cfTrustedPeersError;
1190 CFSetForEach(sosPeerInfoRefs, ^(const void* voidPeer) {
1191 CFErrorRef cfPeerError = NULL;
1192 SOSPeerInfoRef sosPeerInfoRef = (SOSPeerInfoRef)voidPeer;
1194 if(!sosPeerInfoRef) {
1198 CFStringRef cfpeerID = SOSPeerInfoGetPeerID(sosPeerInfoRef);
1199 SecKeyRef cfOctagonSigningKey = NULL, cfOctagonEncryptionKey = NULL;
1201 cfOctagonSigningKey = SOSPeerInfoCopyOctagonSigningPublicKey(sosPeerInfoRef, &cfPeerError);
1202 if (cfOctagonSigningKey) {
1203 cfOctagonEncryptionKey = SOSPeerInfoCopyOctagonEncryptionPublicKey(sosPeerInfoRef, &cfPeerError);
1206 if(cfOctagonSigningKey == NULL || cfOctagonEncryptionKey == NULL) {
1207 // Don't log non-debug for -50; it almost always just means this peer didn't have octagon keys
1208 if(cfPeerError == NULL
1209 || !(CFEqualSafe(CFErrorGetDomain(cfPeerError), kCFErrorDomainOSStatus) && (CFErrorGetCode(cfPeerError) == errSecParam)))
1211 secerror("ckkspeer: error fetching octagon keys for peer: %@ %@", sosPeerInfoRef, cfPeerError);
1213 secinfo("ckkspeer", "Peer(%@) doesn't have Octagon keys, but this is expected: %@", cfpeerID, cfPeerError);
1217 // Add all peers to the trust set: old-style SOS peers will just have null keys
1218 SFECPublicKey* signingPublicKey = cfOctagonSigningKey ? [[SFECPublicKey alloc] initWithSecKey:cfOctagonSigningKey] : nil;
1219 SFECPublicKey* encryptionPublicKey = cfOctagonEncryptionKey ? [[SFECPublicKey alloc] initWithSecKey:cfOctagonEncryptionKey] : nil;
1221 CKKSSOSPeer* peer = [[CKKSSOSPeer alloc] initWithSOSPeerID:(__bridge NSString*)cfpeerID
1222 encryptionPublicKey:encryptionPublicKey
1223 signingPublicKey:signingPublicKey];
1224 [peerSet addObject:peer];
1226 CFReleaseNull(cfOctagonSigningKey);
1227 CFReleaseNull(cfOctagonEncryptionKey);
1228 CFReleaseNull(cfPeerError);
1235 - (void)registerForPeerChangeUpdates:(id<CKKSPeerUpdateListener>)listener {
1236 @synchronized(self.peerChangeListeners) {
1237 bool alreadyRegisteredListener = false;
1238 NSEnumerator *enumerator = [self.peerChangeListeners objectEnumerator];
1239 id<CKKSPeerUpdateListener> value;
1241 while ((value = [enumerator nextObject])) {
1242 // do pointer comparison
1243 alreadyRegisteredListener |= (value == listener);
1246 if(listener && !alreadyRegisteredListener) {
1247 NSString* queueName = [NSString stringWithFormat: @"ck-peer-change-%@", listener];
1249 dispatch_queue_t objQueue = dispatch_queue_create([queueName UTF8String], DISPATCH_QUEUE_SERIAL);
1250 [self.peerChangeListeners setObject: listener forKey: objQueue];
1255 - (void)iteratePeerListenersOnTheirQueue:(void (^)(id<CKKSPeerUpdateListener>))block {
1256 @synchronized(self.peerChangeListeners) {
1257 NSEnumerator *enumerator = [self.peerChangeListeners keyEnumerator];
1258 dispatch_queue_t dq;
1260 // Queue up the changes for each listener.
1261 while ((dq = [enumerator nextObject])) {
1262 id<CKKSPeerUpdateListener> listener = [self.peerChangeListeners objectForKey: dq];
1263 __weak id<CKKSPeerUpdateListener> weakListener = listener;
1266 dispatch_async(dq, ^{
1267 __strong id<CKKSPeerUpdateListener> strongListener = weakListener;
1268 block(strongListener);
1275 - (void)sendSelfPeerChangedUpdate {
1276 [self.completedSecCKKSInitialize wait:5*NSEC_PER_SEC]; // Wait for bringup, but don't worry if this times out
1278 [self iteratePeerListenersOnTheirQueue: ^(id<CKKSPeerUpdateListener> listener) {
1279 [listener selfPeerChanged];
1283 - (void)sendTrustedPeerSetChangedUpdate {
1284 [self.completedSecCKKSInitialize wait:5*NSEC_PER_SEC]; // Wait for bringup, but don't worry if this times out
1286 [self iteratePeerListenersOnTheirQueue: ^(id<CKKSPeerUpdateListener> listener) {
1287 [listener trustedPeerSetChanged];